@bongos/core 1.19.882 → 1.19.884

package/modules/hall-ui/public/collab.css

@@ -21,10 +21,36 @@
    sees it. Four bands, four treatments: faint, soft, warn, danger. The 3px
    coloured band the first cut painted down the row's left edge is gone — this
    world marks state with a pill, never with a bar. */
+/* THE CHIP ONLY WEARS ITS RING PAST THE THRESHOLD (artist verdict, task
+   1004041). All four bands still have their own ink, because that is what makes
+   the column readable at a glance and it is what the criterion asked for. What
+   changed is that the two CALM bands stop being pills: a ring around "just
+   asked" draws a chip on a row where nothing is wrong, so a board of healthy
+   asks opened as a wall of chips and the two bands that actually mean something
+   had no shape of their own left to mean it with. Faint and soft read as plain
+   quiet text; aging and stale keep the pill.
+
+   The WORDS carry the real age now (collab-lib ageLabel), so two stale rows no
+   longer read identically — which is the other half of the same verdict. */
 .cb-age--fresh   { color: var(--ink-faint); }
 .cb-age--waiting { color: var(--ink-soft); }
 .cb-age--aging   { color: var(--warn); }
 .cb-age--stale   { color: var(--danger); font-weight: 600; }
+.cb-age--fresh,
+.cb-age--waiting {
+  border-color: transparent;
+  padding-left: 0;
+  padding-right: 0;
+}
+
+/* ---- the figure strip -----------------------------------------------------
+   The shell's .stat-row, unchanged, except that this page's third tile holds
+   WORDS (the roles you answer for) rather than a figure. The shell's own
+   --badge modifier says that at 15px, but its phone block restates
+   .stat-tile__num at the same specificity and later in the sheet, so on a phone
+   the modifier loses and a list of role names sets at 28px. Two classes here
+   outrank both without touching the shell. */
+.cb-figs .stat-tile__num--badge { font-size: 15px; letter-spacing: -0.02em; }
 
 /* ---- the blocks ------------------------------------------------------------------
    The top band is the shell's two-up grid (it stacks to one column at the
@@ -103,9 +129,13 @@
 .cb-row .ov-row__facts a { color: var(--accent-ink); }
 /* Inside the two condensed blocks a row has half the page: the state and the
    actions drop UNDER the words as one line (the archetype's own phone shape),
-   the date yields to the age pill, and the two-up itself becomes one column
-   before the shell's phone breakpoint, at the width where two half-rows stop
-   holding a sentence. The wide block below keeps the archetype's two columns. */
+   and the two-up itself becomes one column before the shell's phone breakpoint,
+   at the width where two half-rows stop holding a sentence. The wide block below
+   keeps the archetype's two columns.
+   The separate date line this block used to suppress is gone from the markup
+   entirely (task 1004041): the age pill says how long in words and carries the
+   exact timestamp on its title, so a date beside it was the same fact twice —
+   which is what the "All open asks" rows were doing at full width. */
 .cb-band .ov-row--lead { grid-template-columns: auto minmax(0, 1fr); row-gap: 8px; }
 .cb-band .ov-row--lead > .ov-row__right {
   grid-column: 2;
@@ -115,7 +145,6 @@
   text-align: left;
 }
 .cb-band .ov-row__actions { justify-content: flex-start; }
-.cb-band .ov-row__when { display: none; }
 @media (max-width: 1100px) {
   .cb-band { grid-template-columns: 1fr; }
 }

package/modules/hall-ui/public/collab.html

@@ -35,6 +35,13 @@
            where people are asking, their faces. The rows are the hall's row
            archetype (oversight.css) led by a face; collab.js fills them. -->
       <main id="hall-main">
+        <!-- The glass figure strip task 1003942 promised and did not build, and
+             the artist's verdict (task 1004041) asked for by name: three calm
+             numbers a person meets BEFORE any age pill. The shell's .stat-row,
+             the same band Harbor, Gate and the copy desk open on; collab.js
+             fills it from the two reads it already makes. -->
+        <div class="stat-row ov-summary cb-figs" id="cb-figs" aria-label="Where the asks stand"></div>
+
         <div class="view-zone view-zone--band cb-band">
           <section class="scroll cb-block" aria-labelledby="cb-for-me-h">
             <div class="cb-block__head">
@@ -98,7 +105,7 @@
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/collab-lib.js?v=2026-09-16-twosentence"></script>
-<script src="/builders/collab.js?v=2026-09-16-twosentence"></script>
+<script src="/builders/collab-lib.js?v=2026-09-19-agewords"></script>
+<script src="/builders/collab.js?v=2026-09-19-agewords"></script>
 </body>
 </html>

package/modules/hall-ui/public/collab.js

@@ -47,16 +47,15 @@
 
   let settling = false;
 
-  // The age pill: the band's words, in the band's colour (collab.css .cb-age--*).
+  // The age pill: the band picks the colour (collab.css .cb-age--*), the LABEL
+  // carries the real age, so fourteen old rows read as fourteen different ages
+  // instead of fourteen copies of one alarm (artist verdict, task 1004041). The
+  // exact timestamp stays on the title, where a reader who wants the date can
+  // still reach it — which is also why the separate date line that used to sit
+  // under this pill is gone: the same fact twice is one fact too many.
   function ageChip(req, nowMs) {
     const band = L.ageBand(req.created_at, nowMs);
-    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(band.label)}</span>`;
-  }
-
-  function whenLine(iso) {
-    const d = iso ? new Date(iso) : null;
-    if (!d || Number.isNaN(d.getTime())) return '';
-    return `<span class="ov-row__when">${escapeHtml(d.toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' }))}</span>`;
+    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(L.ageLabel(req.created_at, nowMs))}</span>`;
   }
 
   // A DOM id per row that is stable, unique and safe to put in an attribute. The
@@ -183,21 +182,30 @@
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${directionFact(req, 'in')}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
     </li>`;
   }
 
   // Your own ask, led by who you asked, with the two settle actions. Only the
   // asker can settle — the server enforces it in the UPDATE's WHERE, this is
   // just the affordance.
+  //
+  // THE AGE SITS WITH THE FACTS HERE, NOT IN THE RIGHT COLUMN (artist verdict,
+  // task 1004041). On every other block the right column holds one thing and the
+  // age is it. On this one it held the age AND the two settle buttons, so an
+  // alarm in the danger ink and a solid accent control ended up two centimetres
+  // apart — and DESIGN.md spends the accent only on what is pressable or live,
+  // which is precisely the distinction a reader could no longer make. Moving the
+  // pill down to the facts line puts the warning with the other facts about the
+  // ask and leaves the right column as what it is here: the place you act.
   function mineRow(req, nowMs, extra, key) {
     const id = escapeHtml(String(req.id));
     return `<li class="ov-row ov-row--lead cb-row" data-id="${id}"${extra ? ' data-extra hidden' : ''}>
       ${faceHtml(L.faceOf(req, 'out'))}
       <div class="ov-row__main">${askHtml(req, key)}
-        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}</div>
+        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}${ageChip(req, nowMs)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}
+      <div class="ov-row__right">
         <div class="ov-row__actions">
           <button class="btn-accent" data-settle="answered" data-id="${id}">Someone helped</button>
           <button class="btn-ghost" data-settle="withdrawn" data-id="${id}">Withdraw</button>
@@ -214,7 +222,7 @@
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${boardFact(req)}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
     </li>`;
   }
 
@@ -247,6 +255,46 @@
     }
   }
 
+  // ---- the figure strip -------------------------------------------------------
+  //
+  // THREE CALM NUMBERS BEFORE ANY PILL (artist verdict, task 1004041). Task
+  // 1003942's description promised "a glass figure strip at the top (waiting on
+  // you / your open asks / crafts you answer for)" and it was never built — the
+  // grader's narc worker caught the omission and the artist named what it cost:
+  // with no numbers to open on, the first thing a person meets is the wall of
+  // age pills, which is why the two findings were one defect seen twice. So the
+  // strip is the shell's .stat-row, the same glass band Harbor, Gate and the
+  // copy desk open on, and it is drawn BEFORE the blocks in the markup.
+  //
+  // The figures repeat what the block heads count, and that is the point rather
+  // than a duplication: a head's count is found by reading the head, and a strip
+  // is read in one glance at the top of the page. The third one is not a count of
+  // asks at all — it is the roles that decide which asks reach you, which is the
+  // fact behind every empty "Asked of you" and has never been stated on the page.
+  // `badge` is the shell's own modifier for a tile whose value is WORDS rather
+  // than a figure — the display face at 34px is sized for a numeral and sets a
+  // list of role names as a headline.
+  function figureHtml(label, value, sub, badge) {
+    return `<div class="stat-tile">
+      <span class="stat-tile__label">${escapeHtml(label)}</span>
+      <span class="stat-tile__num${badge ? ' stat-tile__num--badge' : ''}">${escapeHtml(String(value))}</span>
+      <span class="stat-tile__sub">${escapeHtml(sub)}</span>
+    </div>`;
+  }
+
+  function paintFigures(forMe, mine, crafts) {
+    const host = $('#cb-figs');
+    if (!host) return;
+    const axis = window.OTB.roleAxisLabel().toLowerCase();
+    // A ROLE LIST IS NOT A NUMBER, so the third tile shows the roles themselves
+    // and falls back to the honest em dash rather than to "0", which would read
+    // as a count of something rather than as "you have not set one".
+    const roles = crafts.map((c) => window.OTB.roleWord(c)).join(', ');
+    host.innerHTML = figureHtml('Waiting on you', forMe.length, forMe.length === 1 ? 'ask' : 'asks')
+      + figureHtml('Your open asks', mine.length, mine.length === 1 ? 'ask' : 'asks')
+      + figureHtml('Roles you answer for', roles || '—', roles ? `your ${axis}` : `no ${axis} set yet`, true);
+  }
+
   // The per-row door. Independent of the block's "Show all N", which flips
   // [data-extra] on the <li>s: this flips one <p> inside one row, so opening a
   // row inside a condensed block and then expanding the block cannot leave either
@@ -323,6 +371,7 @@
     const rowsOf = (r) => ((r && r.ok && r.data && r.data.help_requests) || []);
     const crafts = (forMe.ok && forMe.data && forMe.data.crafts) || [];
 
+    paintFigures(rowsOf(forMe), rowsOf(mine), crafts);
     paintBlock('for-me', rowsOf(forMe), forMeRow, nowMs, true);
     paintBlock('mine', rowsOf(mine), mineRow, nowMs, false);
     paintBlock('all', rowsOf(all), allRow, nowMs, true);
@@ -330,11 +379,15 @@
     const sub = $('#cb-sub');
     if (sub) {
       // task 1003936: the axis word comes from OTB.roleAxisLabel(), never typed.
-      // The VALUES are named through roleLabel() for the same reason the filters are.
+      // task 1004041: the VALUES take roleWord(), not roleLabel() — this is a
+      // sentence, and the page said "Asks to Builders" six lines above "You asked
+      // artists". The opening clause is gone with it: it named the same two
+      // parties the clause after it names, and the page's own head and its three
+      // block headings already say what the page is.
       const axis = window.OTB.roleAxisLabel().toLowerCase();
       sub.textContent = crafts.length
-        ? `Builders asking builders. Asks to ${crafts.map((c) => `${window.OTB.roleLabel(c)}s`).join(', ')}, and to you by name, land in your block.`
-        : `Builders asking builders. With no ${axis} set, only asks addressed to you by name land in your block.`;
+        ? `Asks to ${crafts.map((c) => `${window.OTB.roleWord(c)}s`).join(', ')}, and to you by name, land in your block.`
+        : `With no ${axis} set, only asks addressed to you by name land in your block.`;
     }
 
     // The social half. Best-effort and LAST: an introductions read that fails

package/modules/hall-ui/public/dom-utils.js

@@ -209,6 +209,28 @@
     return s === 'ui' ? 'UI' : s.charAt(0).toUpperCase() + s.slice(1);
   }
 
+  // A CONTROL TAKES roleLabel(); A SENTENCE TAKES roleWord() — the rule task
+  // 1004041 exists to write down, next to the helper that made it necessary.
+  //
+  // roleLabel() capitalises, and that is right for a control: a picker option, a
+  // filter, a column head, a row tag. It is wrong in RUNNING PROSE, where a role
+  // is a common noun. Task 1003936 routed Collab's sub line through roleLabel and
+  // left collab-lib.js lowercase, reasoning about the two call sites separately —
+  // so one screen said "Asks to Builders" six lines above "You asked artists",
+  // which is the same word capitalised two ways on one page, the exact defect
+  // 1003936 existed to remove. Deciding per call site is what guarantees that;
+  // the axis needs two helpers, not one helper and a judgement each time.
+  //
+  // NOT ESCAPE-SAFE, like roleLabel(): a caller rendering it into markup escapes
+  // the result. The acronym exception is the same one, because 'UI' is not a
+  // common noun in any sentence either.
+  function roleWord(d) {
+    const s = String(d || '');
+    if (!s) return '';
+    if (s === ROLE_UNSET) return 'no role yet';
+    return s === 'ui' ? 'UI' : s.toLowerCase();
+  }
+
   // The option list for any Role <select>, so no surface types the values or the
   // labels again. Prefers the roles the SERVER serves (the same list
   // db.updateBuilderDisciplines validates a PATCH against), and falls back to the
@@ -422,7 +444,7 @@
   window.OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn, disciplines,
     // task 1003936 — ONE word for the role axis, all six surfaces
-    roleAxisLabel, roleLabel, roleOptions, roleIsUnset, ROLE_UNSET,
+    roleAxisLabel, roleLabel, roleWord, roleOptions, roleIsUnset, ROLE_UNSET,
     fillKindFilter, kindLabel, kindIsUnset, KIND_UNSET, // task 1003453 — one Kind filler, all three surfaces
     errCode, errMessage, errDetails, // task 1002462 — ADR 0116 envelope readers
     contributeSettingsPanel, settingsPanels,

package/modules/lifecycle/routes/tasks.js

@@ -1357,17 +1357,31 @@ module.exports = function buildTasksRouter() {
     // it here too. Sits BEFORE the credential 503 on purpose: the tip is true
     // regardless, and a later-provisioned credential lets the sweep heal
     // retroactively. Best-effort, mirroring publish-branch.
+    //
+    // task 1004055: and SAY whether it took. setClaimPublishedSha returns null when
+    // no claim row matched, which read identically to success — so a caller that had
+    // just merged to main was told nothing, and only found out one call later as an
+    // opaque ship_land_not_proven 409, with the work already on main and the task
+    // parked at 'confirmed'. `tip_recorded` travels on BOTH exits, so the answer does
+    // not depend on which one the request happens to take.
+    let tipRecorded = false;
     try {
-      await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+      const claimId = await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+      tipRecorded = claimId != null;
+      if (!tipRecorded) log.warn('[gds] attest-gate: no claim row to record the published tip on', id);
     } catch (e) {
       log.error('[gds] setClaimPublishedSha via attest-gate (non-blocking)', id, e && e.message);
     }
     if (!githubPush.isConfigured()) {
-      return res.fail('push_unconfigured', { status: 503, message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
-          'A gate-surface PR will need an owner review until the operator provisions it.' });
+      return res.fail('push_unconfigured', {
+        status: 503,
+        message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
+          'A gate-surface PR will need an owner review until the operator provisions it.',
+        details: { tip_recorded: tipRecorded },
+      });
     }
     const { attested, reason } = await postGateAuthorTrust({ rank: req.builder.rank, sha: headSha, taskId: id });
-    return res.json({ ok: true, attested, reason });
+    return res.json({ ok: true, attested, reason, tip_recorded: tipRecorded });
   });
 
   // GET /override-requests?status=open — Archon queue. Status defaults to open;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.882",
+  "version": "1.19.884",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.882",
+      "version": "1.19.884",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.882",
+  "version": "1.19.884",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-land.js

@@ -438,24 +438,100 @@ async function pollServerPublish(taskId, branch) {
 // Best-effort + never throws: a non-Metic author, an unconfigured server, or a
 // transient failure just leaves the PR un-attested → it escalates (the safe
 // direction). A non-gate PR is unaffected by the attestation either way.
+//
+// task 1004055 — the endpoint does TWO things, and only one of them was ever
+// reported. Besides the attestation (best-effort, and declining is a legitimate
+// answer) it records claims.published_head_sha, the tip that makes the ship
+// PROVABLE — and that half is load-bearing, not best-effort: without it POST /ship
+// refuses the confirmed→shipped flip. So this returns { recorded, attested, reason }
+// rather than undefined, and callers act on `recorded`. It still never throws.
 async function attestGateTrust(taskId, headSha) {
-  if (!headSha) return;
+  if (!headSha) return { recorded: false, attested: false, reason: 'no head SHA to attest' };
+  let r;
   try {
-    const r = await (await cliClient()).tasks.postTasksIdAttestGate({ id: taskId, body: { head_sha: headSha } });
-    if (r.ok && r.data) {
-      if (r.data.attested) {
-        console.log('  ci-land: gate-author-trust attested on the head SHA (Metic+) — a gate-surface PR auto-passes the ADR-0058 gatekeeper.');
-      } else {
-        console.log(`  ci-land: gate-author-trust NOT attested (${r.data.reason || 'rank below Metic'}) — a gate-surface PR will need owner approval; a non-gate PR is unaffected.`);
-      }
-    } else if (r.status === 503) {
-      console.log('  ci-land: the server has no push credential to post the gate attestation (operator: GITHUB_APP_* / GITHUB_PUSH_TOKEN). A gate-surface PR will need owner approval.');
+    r = await (await cliClient()).tasks.postTasksIdAttestGate({ id: taskId, body: { head_sha: headSha } });
+  } catch (e) {
+    // task 1004055: a bare `catch (_) {}` here meant a thrown request error left NO
+    // trace at all — the quietest of the failure shapes, and the one that reached
+    // the builder as an unexplained ship_land_not_proven.
+    console.log(`  ci-land: gate attestation request failed (${(e && e.message) || 'unknown error'}).`);
+    return { recorded: false, attested: false, reason: `request failed (${(e && e.message) || 'unknown error'})` };
+  }
+  const recorded = landProofRecorded(r);
+  if (r.ok && r.data) {
+    if (r.data.attested) {
+      console.log('  ci-land: gate-author-trust attested on the head SHA (Metic+) — a gate-surface PR auto-passes the ADR-0058 gatekeeper.');
     } else {
-      console.log(`  ci-land: gate attestation request failed (HTTP ${r.status}); a gate-surface PR may need a manual re-run / owner approval.`);
+      console.log(`  ci-land: gate-author-trust NOT attested (${r.data.reason || 'rank below Metic'}) — a gate-surface PR will need owner approval; a non-gate PR is unaffected.`);
     }
-  } catch (_) {
-    /* best-effort — never block the ship on the attestation */
+    return { recorded, attested: !!r.data.attested, reason: r.data.reason || null };
+  }
+  if (r.status === 503) {
+    console.log('  ci-land: the server has no push credential to post the gate attestation (operator: GITHUB_APP_* / GITHUB_PUSH_TOKEN). A gate-surface PR will need owner approval.');
+    return { recorded, attested: false, reason: 'the server has no push credential' };
   }
+  console.log(`  ci-land: gate attestation request failed (HTTP ${r.status}); a gate-surface PR may need a manual re-run / owner approval.`);
+  return { recorded, attested: false, reason: `HTTP ${r.status}` };
+}
+
+// landProofRecorded — PURE. Did an attest-gate response actually record
+// claims.published_head_sha (task 1004055)? That row is the durable per-task land
+// proof; without it POST /tasks/:id/ship refuses with ship_land_not_proven and the
+// task strands at 'confirmed' with its work already on main.
+//
+// The server SAYS so in `tip_recorded` — on the 200 body and in the 503's details,
+// because the write deliberately sits BEFORE the credential check. Prefer that.
+// A server that predates the field sends neither, which is the NORMAL state here:
+// an instance runs a PINNED core, so it lags main by however long the pin sits
+// still. For those, fall back to the route's contract — the write is above the
+// credential 503, so 200 and 503 both mean the tip landed and nothing else does.
+// Exported so the truth table is pinned with no server.
+function landProofRecorded(r) {
+  if (!r || typeof r.status !== 'number') return false;
+  const body = r.data || {};
+  const explicit = body.tip_recorded !== undefined
+    ? body.tip_recorded
+    : (body.error && body.error.details ? body.error.details.tip_recorded : undefined);
+  if (explicit !== undefined) return explicit === true;
+  return r.status === 200 || r.status === 503;
+}
+
+// landProofWarningLines — PURE. What to print when the proof did NOT get recorded
+// (task 1004055). Without it POST /ship refuses, the task parks at 'confirmed' —
+// which gates the builder's WHOLE queue — and the publish-reconciler eventually
+// writes strand:land_not_proven, after which nothing heals it. Say it HERE, while
+// the sha is still on screen, and hand over the calls that fix it, rather than
+// letting it surface as an opaque 409 later.
+//
+// `merged` is the tense, and it is the whole difference between the two callers:
+// the local-merge path has ALREADY put the work on main and needs the full
+// two-call recovery now; the PR path has only pushed, so the land may still be
+// minutes away and the same recovery would be premature. Exported so both
+// wordings are pinned.
+function landProofWarningLines(taskId, sha, reason, { merged = true } = {}) {
+  const head = sha || '<the merge commit on main>';
+  const why = `  WARNING: the land proof for task ${taskId} was NOT recorded (${reason || 'unknown'}).`;
+  const fix = `    node scripts/gds/api.js POST /tasks/${taskId}/attest-gate --body '{"head_sha":"${head}"}'`;
+  if (!merged) {
+    return [
+      '',
+      why,
+      '  Nothing is lost yet — the branch is pushed and the PR still lands normally.',
+      '  But if the ship then refuses with ship_land_not_proven, re-record the tip',
+      '  against the merge commit and re-run the ship:',
+      `    node scripts/gds/api.js POST /tasks/${taskId}/attest-gate --body '{"head_sha":"<the merge commit on main>"}'`,
+      `    node scripts/gds/ship.js ${taskId}`,
+    ];
+  }
+  return [
+    '',
+    why,
+    '  The merge IS on main, but the server cannot prove the land is this task\'s, so',
+    '  the confirmed -> shipped flip will be refused (ship_land_not_proven) and the',
+    '  task will park at confirmed — which blocks every new claim you make. Fix it:',
+    fix,
+    `    node scripts/gds/api.js POST /tasks/${taskId}/ship --body '{}'`,
+  ];
 }
 
 // pickStaleGateReviewRun — PURE. Among `gh run list --json
@@ -596,7 +672,14 @@ async function ciLandLocal(taskId, branch, valueSummary) {
   // and a Metic+ gate-surface PR auto-passes — race-free for a fresh PR, since the
   // `gh pr create` below is what fires gate-review and it runs only after this
   // returns. (A reused open PR is handled by the re-run nudge after auto-merge.)
-  await attestGateTrust(taskId, headSha);
+  // task 1004055: the same call also records the land proof, so a miss here is not
+  // cosmetic — check it rather than firing and forgetting. Not fatal on this path:
+  // the branch is pushed and the PR lands regardless, so say what to do IF the ship
+  // is later refused, and carry on.
+  const gateProof = await attestGateTrust(taskId, headSha);
+  if (!gateProof.recorded) {
+    for (const line of landProofWarningLines(taskId, headSha, gateProof.reason, { merged: false })) console.log(line);
+  }
 
   // Ensure exactly one PR for this branch. gh pr create is idempotent-ish: it
   // errors if a PR already exists, so check first and reuse it.
@@ -723,6 +806,12 @@ module.exports = {
   ciLand,
   classifyLandOutcome,
   formatPublishFailure,
+  // task 1004055: the land-proof half of attest-gate. attestGateTrust is exported
+  // so the LOCAL-merge path can record a proof it previously never recorded at all;
+  // the two pure halves so the truth table + the wording are pinned without a server.
+  attestGateTrust,
+  landProofRecorded,
+  landProofWarningLines,
   // task 1002572 (PART 2): the bail ids + the pure "can a PR still land this?"
   // decision, so the single-checkout fallback is opt-in per bail and unit-tested.
   LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,

package/scripts/gds/ship-merge.js

@@ -20,9 +20,11 @@ const { mainIsProtected, pushVia, readDeployConfigRaw, resolveDeployMode, resolv
 const {
   LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,
   LAND_BAIL_NO_TASK_BRANCH,
+  attestGateTrust,
   ciLand,
   landBailRecoverableByPr,
   landBailed,
+  landProofWarningLines,
   landed,
 } = require('./ship-land.js');
 const { runSmoke } = require('./ship-grade.js');
@@ -301,6 +303,32 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       return landBailed('could not push the merged main to origin', '/merge-mode');
     }
 
+    // task 1004055: RECORD THE LAND PROOF — the step this path never had.
+    //
+    // The two OTHER land paths each tell the server which commit is this task's:
+    // ciLandLocal posts attest-gate after its push, ciLandServer gets it from
+    // publish-branch. This path merges and pushes main ITSELF, so nothing ever did,
+    // and claims.published_head_sha stayed NULL. It also opens no PR and deletes the
+    // branch below, so getPublishStatus can find nothing by head ref either — which
+    // left deriveShipAssurance with neither of its two proofs and made the POST /ship
+    // three lines later refuse with ship_land_not_proven, EVERY time, with the work
+    // already merged. The task then parked at 'confirmed', gating its builder's whole
+    // queue, until someone ran the recovery by hand (five consecutive ships,
+    // 2026-09-19; twelve refusals in one day's audit log).
+    //
+    // The merge commit is the sha to record: the push above just put it on main, so
+    // the ancestry check cannot fail, and it is what the hand-recovery always used.
+    // It goes HERE, immediately after the push and BEFORE both the deploy step (which
+    // can bail) and the branch deletion (which destroys the only other evidence) —
+    // the proof must exist from the first moment the work is on main.
+    const mergeSha = gitOk('git rev-parse HEAD', { cwd: REPO_ROOT });
+    const proof = await attestGateTrust(taskId, mergeSha);
+    if (proof.recorded) {
+      console.log(`  auto-merge: land proof recorded (merge ${String(mergeSha).slice(0, 8)} on main).`);
+    } else {
+      for (const line of landProofWarningLines(taskId, mergeSha, proof.reason)) console.log(line);
+    }
+
     // Deploy step. The core carries NO deploy target of its own — under the
     // standalone model a core change reaches a live instance via package-core +
     // `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). So unless an

package/scripts/gds/ship.js

@@ -127,6 +127,8 @@ const {
   landPending,
   landPendingLines,
   landPollAfterAutoMerge,
+  landProofRecorded,
+  landProofWarningLines,
   landed,
   pickStaleGateReviewRun,
   reconcileBlockedLines,
@@ -266,6 +268,12 @@ module.exports = {
   // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
   // a bail. Also pins pending (a poll timeout) as distinct from bailed.
   landed, landPending, landBailed, strandCommand,
+  // task 1004055: the land proof the LOCAL-merge path never recorded. landProofRecorded
+  // is the "did the tip actually land?" truth table (explicit tip_recorded wins; a
+  // pinned older core falls back to the route's before-the-credential-check contract);
+  // landProofWarningLines is the recovery the builder gets when it did not, in the
+  // tense of whichever path is speaking. Both pure — exported so they pin without a server.
+  landProofRecorded, landProofWarningLines,
   // task 1001916: the publish-branch failure formatter — exported pure so both
   // wire shapes (envelope + legacy flat), the step/reason surfacing, and the
   // non-fast-forward remedy hint are pinned without a server.

package/scripts/hall-preview/server.js

@@ -124,9 +124,46 @@ const FIXTURE_FALLBACKS = [
   [/^connections\/degree\/[^/]+$/, 'connections__degree'],
 ];
 
+// A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request
+// fixtures were written with absolute timestamps chosen to land one row in each
+// of collab's four age bands — and three weeks later every one of them had
+// drifted into the oldest band, so the harness rendered fourteen identical
+// "waiting over a week" pills and an artist reviewing the page reasonably read
+// that as the page's own defect. (Half of it was; the other half was this.)
+//
+// So a fixture may write a RELATIVE timestamp: "@-3d" is three days before the
+// moment the page is served, "@-6h" six hours. Resolved on every load, so the
+// bands the fixture was written to demonstrate are the bands it demonstrates a
+// year from now. Any string field may use it; nothing else changes, so a fixture
+// with absolute dates is served exactly as before.
+//
+// WRITE A FRACTIONAL OFFSET. "@-3d" lands exactly on the 3-day band boundary, so
+// whether it reads as 2 days or 3 depends on the milliseconds between this
+// resolve and the browser's own clock — the row flickers between two bands
+// across reloads and a screenshot pass cannot be compared. "@-3.4d" cannot.
+const RELATIVE_AT = /^@-(\d+(?:\.\d+)?)([dh])$/;
+const HOUR_MS = 60 * 60 * 1000;
+
+function resolveRelativeDates(v, nowMs) {
+  if (typeof v === 'string') {
+    const m = RELATIVE_AT.exec(v);
+    if (!m) return v;
+    const hours = Number(m[1]) * (m[2] === 'd' ? 24 : 1);
+    return new Date(nowMs - hours * HOUR_MS).toISOString();
+  }
+  if (Array.isArray(v)) return v.map((x) => resolveRelativeDates(x, nowMs));
+  if (v && typeof v === 'object') {
+    const out = {};
+    for (const [k, val] of Object.entries(v)) out[k] = resolveRelativeDates(val, nowMs);
+    return out;
+  }
+  return v;
+}
+
 function loadFixture(name) {
   try {
-    return JSON.parse(fs.readFileSync(path.join(FIXTURES, `${name}.json`), 'utf8'));
+    const raw = JSON.parse(fs.readFileSync(path.join(FIXTURES, `${name}.json`), 'utf8'));
+    return resolveRelativeDates(raw, Date.now());
   } catch (_) { return undefined; }
 }